A vulnerability in the Linux kernel's firewire cdev component related to the iso_resource_auto client resource state management has been fixed. The issue involved an incorrect back-transition of the resource state from ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC due to concurrent access, which could cause inconsistent resource state handling.
A reference count leak vulnerability was fixed in the Linux kernel function attach_perf_ctx_data(). The flaw occurs due to a race condition between global and non-global cases, potentially causing a reference count leak when the global field is not set correctly. This can lead to resource management issues in the kernel's performance context data handling.
A runtime power management (PM) reference leak was fixed in the Linux kernel's arizona GPIO driver. The issue occurred when switching a persistent GPIO line from input to output, where a runtime PM reference was acquired but not released if a subsequent update operation failed. This could lead to resource leaks affecting power management.
A vulnerability in the Linux kernel's gpio driver for Zynq devices causes a runtime power management (PM) reference leak when an error occurs during GPIO request. This leak prevents the controller from runtime-suspending, leaving its clock enabled unnecessarily. The issue arises because pm_runtime_get_sync() increments the usage counter even on failure, and the error path does not properly decrement it. The fix involves switching to pm_runtime_resume_and_get(), which increments the usage counter only on success.
CVE-2026-98520 is a use-after-free and multi-container mapping gap vulnerability in the Linux kernel's drm/amdkfd component. It affects the kfd_dev_mapping mechanism that caches the address_space of the first /dev/kfd opener. The flaw leads to a dangling pointer dereference causing a hard hang during GPU reset and stale mappings that can expose doorbell and MMIO pages to userspace after GPU reset. The issue primarily manifests under SRIOV with multiple containers. The vulnerability has been fixed by changing the inode management to a module-owned anonymous inode shared across all openers, eliminating dangling pointers and ensuring all mappings are properly unmapped during GPU reset.
A runtime power management (PM) reference leak vulnerability exists in the Linux kernel's amdgpu driver. The function amdgpu_debugfs_test_ib_show() may leak a runtime PM reference if interrupted while acquiring a reset domain semaphore, causing the GPU to remain awake unnecessarily. This issue has been fixed by ensuring the runtime PM reference is properly dropped on error paths.
CVE-2026-98518 is a high-severity vulnerability in the Linux kernel's nouveau DRM driver related to GPU memory management. A recent commit increased the registered device-private memory region size without resizing the backing VRAM buffer object accordingly. This mismatch causes address resolution errors for VRAM pages beyond the first chunk, potentially leading to unauthorized memory access. The issue has been fixed by sizing the buffer object to match the entire registered region.
A runtime power management (PM) reference leak was fixed in the Linux kernel's nouveau driver in the function nouveau_connector_detect(). If the function nvif_outp_edid_get() fails, the runtime PM reference was not properly released, causing the device to remain powered on unnecessarily until the next successful detection. This issue has been corrected by balancing the runtime PM references on all exit paths.
CVE-2026-98510 is a high-severity vulnerability in the Linux kernel's drm/xe virtual memory management subsystem. It involves a race condition where page tables (PTs) are destroyed before contested virtual memory areas (VMAs) are unlinked, leading to a NULL pointer dereference. This occurs when concurrent threads evict shared buffer objects while the PT root is prematurely destroyed. The flaw has been fixed by deferring PT destruction until after all contested VMAs are properly unlinked and destroyed.
CVE-2026-98507 is a high-severity vulnerability in the Linux kernel's memory management subsystem related to a missing memory barrier between anon_vma initialization and its publication to a virtual memory area (VMA). This flaw can cause a use-after-free (UAF) condition and lead to deadlocks when two threads concurrently fault on adjacent VMAs that are anon_vma-compatible. The issue arises from reordered memory stores and insufficient synchronization, causing anon_vma locks to be inconsistently held and released. The vulnerability affects Linux kernel version 2.6.36 and has been fixed in later commits.
A vulnerability in the Linux kernel's huge page memory management subsystem was fixed. The flaw involved improper handling of gigantic huge pages without runtime support, leading to potential corruption of the free list during memory operations. This could occur when certain functions freed a still-listed folio, and a failure in vmemmap restore caused rollback corruption.
CVE-2026-98505 is a vulnerability in the Linux kernel's memory management subsystem related to huge page table entries. The flaw involves a race condition where hardware-driven updates to page table entries can be lost during the damon_hugetlb_mkold() function execution. This can cause hardware-updated dirty bits to be lost, though no critical issues are expected due to the nature of hugetlbfs. The vulnerability has been fixed in specific Linux kernel commits.
CVE-2026-98503 is a vulnerability in the Linux kernel's packet subsystem involving the handling of TX_RING packets. The issue arises from premature release of ring slots due to skb destructor calls, which could lead to reuse of slots still linked to socket buffers. The fix involves switching to standard zerocopy completion to ensure slots are only released after all references are freed or copied, preventing in-flight state aliasing and improving memory management.
A vulnerability in the Linux kernel's EDAC/altera driver was addressed by changing the device resource management in the altr_portb_setup() function to use the parent device for devres operations. This ensures proper anchoring of resource groups and IRQ requests to the long-lived parent device, preventing resource management inconsistencies.
A vulnerability in the Linux kernel Bluetooth subsystem related to CIS (Connected Isochronous Stream) hold ownership on reuse has been fixed. The issue involved improper handling of connection holds in functions hci_bind_cis() and hci_connect_cis(), which could lead to inconsistent state management during CIS configuration and reuse. The fix ensures proper hold acquisition and release to maintain documented ownership contracts and prevent state inconsistencies.
CVE-2026-98456 is a high-severity vulnerability in the Linux kernel's Bluetooth management subsystem. It involves a race condition in the read_unconf_index_list() function, which can cause an out-of-bounds write due to inconsistent counting and filling of unconfigured Bluetooth controllers. This flaw arises because the per-device flags are not properly serialized during asynchronous controller setup, leading to memory corruption risks.
A vulnerability in the Linux kernel SMB client related to handling cached directory opens has been resolved. The issue involved improper handling of CREATE and QUERY_INFO compound requests, where a successful CREATE followed by an error in a later command could lead to incorrect resource management. The fix ensures proper validation of CREATE responses, correct tracking of file identifiers (FIDs), and appropriate cleanup of handles to prevent resource leaks or inconsistent states.
A vulnerability in the Linux kernel's SMB client handling causes improper management of compound message IDs (mids) on send failure. Specifically, when sending a compound request fails, the mids remain on the pending queue and are not properly deleted before unlocking the server, leading to double decrement of in-flight credits and kernel warnings. This issue was observed during SMB2 negotiation when socket send fails and has been fixed in Linux kernel version 4.21.
A vulnerability in the Linux kernel's Qualcomm iris media driver caused runtime power management (PM) reference leaks due to improper handling of PM usage counts. The issue was fixed by ensuring proper use of pm_runtime_resume_and_get() and always calling pm_runtime_put_sync() to maintain balanced runtime PM references.